Detection Guidance

This vulnerability can be detected by monitoring and analyzing requests to the endpoint POST /settings/jellyfin/server-url-verify in the Movary application prior to version 0.71.1.

Since the vulnerability involves server-side requests to arbitrary internal targets triggered by user-controlled URLs, detection can involve checking for unusual or unexpected URLs being sent in POST requests to this endpoint.

Commands to detect exploitation attempts could include inspecting web server logs or using network monitoring tools to identify POST requests to /settings/jellyfin/server-url-verify with suspicious URL parameters.

• Use grep or similar tools to search web server logs for POST requests to the vulnerable endpoint, for example: grep 'POST /settings/jellyfin/server-url-verify' /var/log/nginx/access.log
• Use curl or similar tools to test the endpoint manually by sending POST requests with controlled URLs to see if the server makes outbound requests.
• Monitor outbound HTTP requests from the server to detect unexpected connections to internal IP addresses or metadata endpoints.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to perform server-side request forgery (SSRF) to internal network targets, potentially accessing internal administrative services or cloud metadata endpoints. This could lead to unauthorized internal reconnaissance and data exposure.

Such unauthorized access and potential data exposure may impact compliance with standards like GDPR and HIPAA, which require protection of sensitive data and internal systems from unauthorized access.

However, the provided information does not explicitly state the direct effects on compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Movary, a self-hosted web app for tracking and rating movies, prior to version 0.71.1. An ordinary authenticated user can exploit the endpoint POST /settings/jellyfin/server-url-verify by providing a user-controlled URL. The server appends /system/info/public to this URL and makes a server-side HTTP request without restricting internal hosts, loopback addresses, or private network ranges.

Because of this lack of restriction, the vulnerability allows Server-Side Request Forgery (SSRF) attacks, enabling an attacker to make the server connect to arbitrary internal targets. This can be used for internal network reconnaissance such as discovering hosts, probing port states, and fingerprinting services.

In some deployments, this may also allow access to internal administrative services or cloud metadata endpoints that are not accessible externally. The issue was fixed in version 0.71.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with ordinary authenticated access to perform SSRF attacks through the vulnerable endpoint.

• Internal network reconnaissance, including host discovery.
• Port-state probing to identify open or closed ports.
• Service fingerprinting to gather information about internal services.
• Potential unauthorized access to internal administrative services or cloud metadata endpoints that should not be externally accessible.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Movary to version 0.71.1 or later, as this version fixes the vulnerability.

Useful 0 Not Useful 0